Alerting configured for error rate spikes; thresholds defined; alert destinations configured
Why it matters
An error rate that spikes from 0.1% to 15% without triggering an alert means your team finds out from a user tweet, not a PagerDuty notification. NIST SI-4 and NIST CSF DE.AE-3 require automated detection of anomalous system events; ISO 25010 reliability.fault-tolerance requires that faults be detected and responded to. Without defined thresholds and alert destinations, error rate monitoring is passive — a dashboard that nobody checks during an incident rather than an active signal that wakes someone up.
Severity rationale
Low because error alerting is a detection mechanism, not a prevention mechanism — its absence degrades response time rather than directly causing failures.
Remediation
Configure an error rate alert in your monitoring service. For Datadog:
- Monitors → New Monitor → Metric
- Query:
avg:trace.web.request.error_rate{service:your-app} by {env} - Alert threshold: > 0.05 (5%) for 5 consecutive minutes
- Notification:
@slack-incidents @pagerduty-oncall
For Prometheus + Alertmanager:
# prometheus-alerts.yml
groups:
- name: app
rules:
- alert: HighErrorRate
expr: rate(http_requests_total{status=~"5.."}[5m]) / rate(http_requests_total[5m]) > 0.05
for: 5m
annotations:
summary: "Error rate {{ $value | humanizePercentage }} on {{ $labels.instance }}"
Document the alert owner, threshold justification, and expected response steps in INCIDENT_RESPONSE.md.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Deployment Readiness Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · reliability.fault-tolerance — Fault Tolerance — error rate alerting enables timely response to failures
- nist:rev5 · SI-4 — System Monitoring
- nist-csf:2.0 · DE.AE-3 — Detect — Event data are collected and correlated from multiple sources
- soc2:2017 · CC7.2 — Monitoring for anomalous system activity
Taxons
History
- 2026-04-18·v1.0.0·Initial import from deployment-readiness·automated
- 2026-07-06·v1.0.1·Add SOC 2 TSC mapping (CC7.2) from the verified compliance crosswalk register (docs/compliance/).·by soc2-mapping-enrichment-ship-2